Privacy notice for prospective students

Published 31.1.2020 | Updated 10.8.2026

1. Controllers

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

The education and teaching organisers and the Finnish National Agency for Education are the joint controllers of the Studyinfo student admissions register.

2. Unit and person in charge of processing personal data

Senior Head of Academic Affairs Milla Vaisto-Oinonen
Email: hakijapalvelut@uniarts.fi
Phone number: +358 294 47 2000 (switchboard)

3. Contact persons for processing personal data

• Specialist Hanna Björksten, Studyinfo
• Specialist Lotta Palin, Sibelius Academy international exchange
• Coordinator Hannele Ylönen, Theatre Academy admissions
• Planning Officer Ulla Tissari, Academy of Fine Arts international exchange
• Specialist Leena Veijonsuo, Sibelius Academy international exchange
• Planning Officer Jyri Äärilä, Theatre Academy international exchange
• Senior Advisor Mari Karjalainen, adult and continuing education

Email: hakijapalvelut@uniarts.fi
Phone number: +358 294 47 2000 (switchboard)

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register and brief description

The student admissions register

The Studyinfo register acts as the national register of student admissions in degree-oriented education. The Finnish National Agency for Education is the joint controller of the register. The Finnish National Agency for Education is in charge of gathering the data in the student admissions register, providing application systems in Finland and providing information, guidance and advice related to student applications and admissions. All higher education institutions participate in maintaining the register by keeping their own respective sub-registers up to date and by complementing the Studyinfo data with data required for their own admission.

As regards prospective students applying for a fixed-term right to study, Uniarts Helsinki gathers personal data on applicants based on the type of right to study:

• Data on the right to study JOO studies.
• Data on international exchange students.
• Data on Junior Academy applicants.
• Adult education: data on persons who are applying for Open University studies, professional specialist education and continuing education.
• Data on persons applying for the right to complete non-degree studies.

6. Purpose and legal basis for the processing of personal data

The purpose for processing personal data is to enable student admissions, the granting of the right to study and the fulfilment of the university’s official duties as a university.

Uniarts Helsinki processes personal data in connection with student admissions for:

1. Providing information on studies and student admissions.
2. Organising application and admissions processes and acceptance of admissions as well as monitoring applications and admissions.
3. Providing information required for student admissions, admissions development and the organising of studies to universities, universities of applied sciences and to organisers of vocational training, upper secondary school education and voluntary additional primary and lower secondary education.
4. Informing applicants who did not receive an offer of admission of study opportunities.
5. Producing information about applicants and admitted students in order to monitor and assess the education system.
6. Other activities necessary in student admissions.

In practice, personal data is processed when selecting students for studies leading to bachelor’s and master’s degrees as defined in the Universities Act (558/2009), for example when determining eligibility, organising entrance examinations, making admissions decisions, sharing information about studies and admissions decisions, compiling statistics and developing and analysing the admissions process. The student admissions register is also used for monitoring restrictions applied to accepting an offer of admission. The student admissions register is also used for doctoral student admissions.

In many processes, the submission of personal data is a necessary prerequisite for handling the matter.

The legal basis for processing personal data of prospective students is:

• Fulfilment of legal obligations as a university (Act on the National Registers of Education Records, Qualifications and Degrees (884/2017).
• Performance of a task carried out in the public interest or exercise of public power.
• Consent to disclose the applicant’s personal data and contact information for marketing purposes of Uniarts Helsinki’s Open University and for study-related marketing outside the university.

The legal basis for processing the personal data of prospective students is:

• Performance of a task carried out in the public interest or exercise of public power.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

Uniarts Helsinki processes the following personal data in connection with student admissions:

• Identification data (the applicant’s name, learner ID and personal identity code or similar unique identifier).
• Background information (nationality, gender and first language).
• Contact information (email address, phone number and postal address).
• Data on the application for studies and admissions criteria.
• Various documents that are possibly needed in the admissions and that may include personal data (artistic samples in electronic format, advance assignments, CV, motivational essay, previous study and language certificates, medical certificate for special arrangements, possible recommendations and job certificates).
• Health data that affects a person’s career choice and is needed in the admissions as well as data related to the applicant’s job experience and hobby activities.
• Data on the applicant’s previous education and completed degrees.
• Data on the result of the admissions, acceptance of an offer of admission and possible enrolment in an educational institution.
• Data on student exchange participants (in addition to basic data related to the admissions, the start and end dates of the exchange period, home institution and exchange programme).
• The applicant’s consent or refusal to disclose name and address details for study-related communication and marketing purposes.
• As regards minors applying to the Junior Academy, the university needs the names and contact details of the applicant’s guardians and study-related data from the applicant’s comprehensive school and/or upper secondary school in addition to the basic data related to the admissions.
• In admissions to the professional specialist education, the university needs information on the applicant’s job title, employment relationship, employer and job duties applicable during the application stage, city where the work takes place and highest completed degree in addition to the basic data related to the admissions.

For further information visit Studyinfo.

8. Where do we get data?

Personal data is gathered from the data subjects themselves.

In addition, Uniarts Helsinki gathers data from the following sources:

• Studyinfo (as regards admissions to degree-oriented education, data concerning the applicant and their target programme and degree).
• The applicant’s guardian (personal data of a Junior Academy applicant).
• Admission boards (assessment data concerning an applicant).
• VIRTA study information system.
• Population Information System.
• International application and degree systems or services (provide documents related to an applicant’s educational background).
• National and international language test organisers.
• Finnish and foreign higher education institutions.
• Online payment and registration services.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

Uniarts Helsinki may use outsiders for the processing of personal data, such as companies offering system services, which process personal data on behalf of Uniarts Helsinki based on an assignment agreement.

Uniarts Helsinki discloses the required personal data to the following recipients and for the following purposes:

• Studyinfo.
• Registers of national and international joint programmes maintained by higher education institutions.
• KOTA database of the Ministry of Education and Culture.
• Internationalisation services of the Finnish National Agency for Education.
• VIRTA study information service of the Finnish National Agency for Education (data on exchange students).
• Paytrail service (if the registration requires a payment, the applicant’s address details will be provided to the service for payment).
• The ministry in question and the Central Statistical Office of Finland for compiling reports on the review of the educational system.
• Social Insurance Institution of Finland for handling matters related to student financial aid, school transport subsidy and rehabilitation (Acts 65/1994, 48/1997, 566/2005).
• Social Insurance Institution of Finland for determining eligibility for unemployment benefits (Act on Unemployment Security 1290/2002).
• Finnish Immigration Service for the purpose of carrying out tasks (615/2020) prescribed in the Aliens Act (301/2004) or Citizenship Act (359/2003).
• For scientific research purposes.
• To fulfil the obligations of the Act on the Openness of Government Activities (621/1999).
• If the applicant gives their consent, for marketing purposes of Uniarts Helsinki’s Open University, to unions and for other marketing.

Personal data will not be transferred outside the EU/EEA area in connection with student admissions except in the situations mentioned above.

Personal data may be transferred outside the EU/EEA area when verifying the authenticity of certificates issued outside the EU.

Personal data may be transferred outside the EU/EEA area also via the Surveypal survey platform. Surveypal has outsourced data processing to subcontractors located outside the EU/EEA area.

In cases where we transfer personal data outside the EU/EEA, we have taken appropriate security measures in connection with the transfer. We use the standard contractual clauses adopted by the EU.

10. How do we protect data and for how long do we store it?

Your data is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process personal data.

As the data controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We take reasonable steps to ensure that the data subject’s personal data being stored in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

Retention periods for data are based on applicable legislation and the information management plan of Uniarts Helsinki.

Data of the student admissions register maintained by the Finnish National Agency for Education is kept for a period of five years as of the making of an admissions decision. However, the data on accepting offers of admission is kept in the application register of higher education institutions on a permanent basis (Act 884/2017).

Data deemed necessary for the assessment and monitoring of education or data deemed valuable as research source material for other reasons is kept on a permanent basis as determined separately by the archive institution. The national learner ID and the identification data based on which the learner ID has been issued are also stored permanently.

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
  • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
  • Applicable when the processing is based on an agreement or consent.
• Right to withdraw their consent.
  • Applicable when the processing is based exclusively on consent.
  • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies.

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.

As regards data in the Studyinfo student admissions register, you can contact the Finnish National Agency for Education.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.